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Sir: 

The Applicant ' s representative Anatoly Frenkel had an in- 
person interview with the Examiner John Macilwinen on November 
16, 2010 . The summary of the interview prepared by the Applicant 
is presented herein . * 



1 



Application No. 10/727, 153 



Docket No: EMC - 101 (US) 



In reference to the first item of the interview agenda 
(sent to the Examiner on October 27, 2010) , the Applicant 
discussed arguments contained in the filed RCE of April 20, 2010 
in regard to a clarification/amendment in the independent claims 
of the content of the collected data (added in the filed RCE) to 
overcome references quoted by the Examiner . 

The Examiner pointed out that the terms "substantive 
content or a message" are not well defined; the Applicant agreed 
with the Examiner; one possibility for clarifying the RCE 
amendment for claim 129 would be: 

129. (Currently Amended) A method, comprising: 

collecting a plurality of transmission events provided by 
one or more nodes of a network into one or more data 
structures ; and 

creating one or more characterization records for at least 
one data structure of said one or more data structures , one or 
more transmission events of said plurality of the transmission 
events being collected to said at least one data structure of 
said one or more data structures , wherein at least one of said 
one or more characterization records comprises one or more 
indicators of a location or locations of one or more data 
elements stored in said one or more data structures and 
comprising ^— su bstantive content or a me s^e any portion up to 
and including an unabridged version of the comprised in at least 
one of said one or more transmission events, said any portion 
not being comprised in any of said one or more characterization 
records, to allow accessing said a t least one of the one or more 
characterization records to determine said one or more 
indicators of the location or locations of said one or more data 
elements . 

Unambiguous support for the proposed amendment may be found 
on page 11, lines 14-17 of the originally filed patent 
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application. The Applicant encouraged the Examiner to carefully 
consider the proposed amendment while preparing an Office Action 
for the submitted RCE of April 20, 2010 . 

*** 

In reference to the second item of the interview agenda 
(sent to the Examiner on October 27, 2010) , the Applicant 
discussed obviousness , primarily related to combining teachings 
of Khanolkar and Wiley in reference to claim 12 9. The Examiner 
expressed disagreement with most arguments presented by the 
Applicant . 

For example, arguments (similar to the arguments presented 
in the Reply Brief of the related patent application No 
11/441,998, pages 22-28) were presented in reference to the 
"improved" performance of Wiley over Khanolkar in order to solve 
the problem (detection of intrusion events) disclosed in both 
inventions of Wiley and Khanolkar. The Applicant argued that the 
process of parsing of the transmission event object in Khanolkar 
does not require storing the event and is faster 
("instantaneous", see col. 7, lines 14-22 of Khanolkar) for 
detecting intrusion events than in Wiley. Even though the 
received data may be stored in Khanolkar for a future use (which 
is undefined in Khanolkar) , it is not relevant to the problem to 
be solved by both Wiley and Khanolkar and thus not providing any 
incentive for a person of the ordinary skill in the art to 
incorporate teaching of Wiley utilizing a dataset technique for 
storing and retrieving information for determining of the 
intrusion events into Khanolkar, because the procedure for 
determining the intrusion event in Wiley et al . is most likely 
slower than the parsing technique disclosed by Khanolka . The 
Examiner disagreed with the presented arguments . 

Further, it was argued by the Applicant that incorporating 
Wiley into Khanolka will limit the content of the event object 
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created in Khaonlka to only those event features which are 
disclosed by Wiely which will destroy the intended function of 
Khanolka . The Examiner disagreed with the presented arguments. 

Moreover, combination of Khanolkar et al . and Wiley et al . 
will teach away from the subject matter recited in the present 
patent application, e.g. , in claim 129, especially in light of 
the claim amendment submitted with the RCE . 

Furthermore, the Applicant proposed (per agenda sent to the 
Examiner on October 27 , 2010) to discuss the concept of 
"teaching away", "reasonable expectation of success", "problem 
to be solved", "obvious to try", and/or "reason to combine" 
concepts as possibly applied to combining Khanokar et al. and 
Wiley et al . in light of new KSR guidelines published by the 
USPTO on September 1, 2010: Federal Register, 75, No. 169, 53643 
Examination Guidelines Update: Developments in the Obviousness 
Enquiry After KSR v Teleflex. The Examiner declined the 
proposed discussion, because he was not properly instructed and 
trained by the USPTO in regard to these new KSR guidelines. 

*** 

In reference to the third item of the interview agenda 
(sent to the Examiner on October 27, 2010) , the Applicant 
proposed a few option for clarifying the language of the 
proposed amendment (see above) . The Examiner stated that he 
would consider such proposals while working on the current RCE 
of April 20, 2010. The Applicant encouraged the Examiner to 
carefully consider the proposed amendment and communicate 
possible counter -proposals (if any) to the Applicant while 
preparing an Office Action for the submitted RCE of April 20 , 
2010 . 
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CONCLUSION 

The objections and rejections of the Final Office Action of 
January 22, 2010 and advisory action of March 22 , 2010 , having 
been obviated by amendment or shown to be inapplicable in RCE 
submitted to the USPTO on April 20, 2 010; withdrawal thereof is 
requested and passage of all claims to issue is earnestly 
solicited. 



Respectfully submitted, 

KELLEY DRYE & WARREN LLP 

Attorneys and Agents for Applicants 



Date: November 19, 2010 
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